✏️Note: In this document, we use Azure Active Directory (AAD) to illustrate the process, but Aidi is also compatible with the OpenID Connect protocol (OIDC).

Azure AD Integration with Aidi

Azure Active Directory Authentication Registration Process

Adding Optional Claims for Aidi SSO Integration

Azure AD Iintegration with Aidi

What is Azure AD used for? 

Aidi uses Microsoft Azure Active Directory (AAD) for identity and access management to enable you to identify yourself securely in the application. In this way, a user in your organization will be able to log in using the same credentials as his or her email or workstation, for example, via the single sign-on (SSO) process. 

✏️Note: It is possible to synchronize your Active Directory with Azure Active Directory using Microsoft’s Azure AD Connect tool. For more information, see Microsoft Entra Connect Sync: Understand and customize synchronization  | Microsoft Docs

Identification Process

From the user’s standpoint, authentication is very simple. On the Aidi home page, the user simply selects the Login with your organization’s credentials option. 

A Microsoft login window will then be displayed. 

If authentication is successful, the user will have access to the assigned resources, otherwise an error message will be displayed. If an access profile is not assigned to the new user by the Aidi admin, then the user will be able to authenticate to Aidi, but won’t have access to any pages. 

Configuration of Azure Active Directory

To begin the  integration, the Aidi application must be registered in your Microsoft account in order to establish a relationship of trust with your identity platform. One of the following administrator roles is required: 

● Application Administrator 

● Application developer 

● Cloud application administrator 

Once the application has been created, a Reply URL must be added. This URL is where the Microsoft Identity Platform redirects a user’s client and sends security tokens after authentication. To complete the configuration, access must be granted to the Aidi API. These accesses specify what information the application will have about your organization’s users. In addition, we strongly recommend granting administrators consent to Aidi.io to avoid users having to manually approve the reading of their email address and profile details.

Azure Active Directory Authentication Registration Process

1. Navigate to portal.azure.com and search for the Azure Active Directory service.

2. On the Azure Active Directory service page for your organization, navigate to App registrations.

3. Select New registration. 

4. Enter the Name for the new registration, ‘’Aidi’’ is recommended. 
5. Then select the first option within Supported Account Types. This will create a single tenant application, meaning the application will only be visible to your organization.
6. Leave the Redirect URI field empty.
7. Press Register

You will be redirected to the application screen.

8. Take note of the Application (client) ID and Directory (tenant) ID and forward them to the Aidi implementation manager you are working with.
9. Once you’ve written the IDs down, navigate to Add a Redirect URI. 

10. Select Add a platform. 
11. On the right side of the screen, you will see a tray open, select Single-page Application. 

12. Enter one of the URIs you’ve been provided by your implementation manager under Redirect URIs. 
13. Leave the Front-channel logout URL blank.
14. Check both checkboxes underneath Implicit grand and hybrid flows.
15. Click the Configure button at the bottom of the page. 

You will have to repeat this process for every URI you’ve been issued by the Aidi team. The URIs will typically be in the format  https : //<organization>.aidi.io/user/login/. 

16. You should now have the list of URIs available at the top of the page.
17. Make sure both checkboxes under the Implicit grand and hybrid flows section are checked.
18. Select Single Tenant under the Supported account types section.
19. Select Yes in the Allow public client flows section.
20. Click Save at the top of the page.

The last step is now to add the missing permissions.

21. Navigate to API Permissions on the left side of the screen. 
22. Once on the page, select Add a permission. You should see a tray open up. 

23. In the tray, select Delegated Permissions. 
24. Underneath Select Permissions you should find an email permission, check it. 
25. Click the Add permissions button at the bottom of the page. 

You may choose to grant consent to the application as an administrator. This will prevent each user in your organization from having to grant consent. This last step is optional.

26.  If you wish to do so, simply click Grant admin consent for aidi.io.

This completes the configuration to be done on the client side. With the Application (client) ID and Directory (tenant) ID provided, Aidi will finish the implementation of this integration. Your implementation manager will advise you when the integration will be activated. Once activated, you can ask a few users with access to Aidi to confirm the integration is operational. 

Adding optional claims for Aidi SSO Integrations (optional)

✏️Note: You can also configure the optional claims if the family_name and given_name are populated on your side. This allows to have a clear input of the first_name and last_name in Aidi when the user is created. 

Adding the claims family_name and given_name in the token will allow the backend to extract the first name and last name set out in the user’s profile by decoding the token. To add these claims, follow these steps in Azure:

1. Go to App registrations page.

2. Select the application created in the previous section of this document.

3. In the Manage section, select Token configuration.

4. Under the Optional claims section, click on Add optional claim to add the given_name and family_name claims.
5. Select the ID for the Token type.